A newly discovered malware sample called CLOSEDQUORUM represents a major shift in how cyberattacks might be carried out in the future. Rather than relying on hackers personally issuing every command, CLOSEDQUORUM can independently pick its next action by querying large language models (LLMs). Once set up and deployed on a Windows system, it reaches out to multiple AI services to decide whether to steal credentials, hide its presence, or retain access.
This malware was identified by Cisco Talos researchers through their CAIRN project. As of now, there’s no recorded incident of it being used in a real-world campaign, and the builds that have been analyzed include dummy credentials and placeholder reporting addresses. Experts emphasize that CLOSEDQUORUM should be viewed more as a proof-of-concept for a possible threat, rather than an active, large-scale concern.
How CLOSEDQUORUM Operates
Once installed, CLOSEDQUORUM gathers basic system information—such as the operating system, number of processors, and whether it has admin privileges—and sends that data to multiple AI models including DeepSeek, Qwen, Mistral, and Gemini. It provides each model with a fixed set of possible actions. Each model votes on its recommendation, and the decision with the most votes is executed. In the event of a tie, a predetermined order of preference (starting with DeepSeek) decides the outcome.
Available actions include extracting browser credentials, wallet files, or Windows login secrets; injecting into running processes; or setting up mechanisms for persistence. One listed option, spreading across a network, lacks a functioning execution module in the analyzed builds. While the system can report stolen data via a Discord webhook, some limitations—such as possibly known encryption keys—suggest certain operational risks or constraints for attackers.
What This Means for Defenders
CLOSEDQUORUM abandons traditional control-server architecture. Instead of communicating with a command-and-control server, it sends requests to several AI providers, making detection harder. Security teams can no longer rely on blocking or flagging a single server to spot malicious behavior.
Defensive teams may be able to spot it by watching for certain behavior combinations: a Windows process reaching out to multiple AI model endpoints unusually quickly; accessing password stores; injecting code into other processes; creating persistence so the malware restarts later; and sending data to Discord or similar platforms via webhooks. It also appears to have a periodic behavior pattern after an initial delay, typically activity bursts every five to fifteen minutes.
Researchers also noted artifacts in the codebase linking to contributors active in carding forums, though there is no proof this implies a live campaign or known victims. They warn that future variants could refine CLOSEDQUORUM’s response timing, error handling, and overall autonomy.
Indicators of compromise include several SHA-256 hashes tied to the builder’s development chain, domains belonging to the utilized AI providers, filenames within staging paths, and known persistence mechanisms in Windows. None of these alone confirm infection, but together they point to the malware’s emerging design.
Analysis: CLOSEDQUORUM shows how attackers are embracing AI not just as a tool, but as an active decision-making partner. While it’s not yet deployed in the wild, it maps out a clear blueprint: malware that adapts and acts even when its operator is offline. For defenders, the takeaway is urgent. Modern detection must go beyond static signatures and known command servers. Building visibility into how systems interact with external AI services, monitoring process behavior and workflow patterns, and correlating these signals will be essential as these hybrid threats become more common. Watch for closed-loop malware designs—that’s where the real challenge lies.
